Hi,
basiclly, i'm working on a captive portal, who add some rules in
PRE/POSTROUTING mangle table when a user is fully authenticated.
$IPTABLES -t mangle -N OUT-AUTH
$IPTABLES -t mangle -A PREROUTING -j OUT-AUTH
$IPTABLES -t mangle -N IN-AUTH
$IPTABLES -t mangle -A POSTROUTING -j IN-AUTH
and the following rules are append when an user is authenticate:
$IPTABLES -t mangle -A OUT-AUTH -s $IP -m mac --mac-source $IP -j MARK
--set-mark 10
$IPTABLES -t mangle -A IN-AUTH -d $IP -j ACCEPT
I dicovered ipset, and begin to play with it.
If my understand of is correct, i can add:
ipset -N TEST macipmap --network 192.168.100.0/24
$IPTABLES -t mangle -A IN-AUTH -m set --set TEST src,dst -j ACCEPT
$IPTABLES -t mangle -A OUT-AUTH -m set --set TEST src,dst -j MARK
--set-mark 10
And when an user authenticate, add the following ipset:
ipset -A TEST 192.168.100.2,xx:xx:xx:xx:xx:xx
However, for some accountig reason, i used to check the iptables
counters (-nvxL) by ip.
If i replace, my iptables rules by an ipset type, i cannot check
counters anymore.
If i decide to use ipset, is there a way to check counters by ip, or
something like that?
Regards.
--
Jean-Philippe Menil - Pôle réseau Service IRTS
DSI Université de Nantes
jean-philippe.menil@xxxxxxxxxxxxxx
Tel : 02.53.48.49.27 - Fax : 02.53.48.49.09
--
To unsubscribe from this list: send the line "unsubscribe netfilter" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
